diff options
| author | Florian Westphal <fw@strlen.de> | 2020-04-11 21:05:01 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-04-12 21:04:08 -0700 |
| commit | e154659ba39a1c2be576aaa0a5bda8088d707950 (patch) | |
| tree | 35d3133115483b71105b54d15b5012fbe9ecfe5c /drivers/net | |
| parent | 3fe260e00cd0bf0be853c48fcc1e19853df615bb (diff) | |
mptcp: fix double-unlock in mptcp_poll
mptcp_connect/28740 is trying to release lock (sk_lock-AF_INET) at:
[<ffffffff82c15869>] mptcp_poll+0xb9/0x550
but there are no more locks to release!
Call Trace:
lock_release+0x50f/0x750
release_sock+0x171/0x1b0
mptcp_poll+0xb9/0x550
sock_poll+0x157/0x470
? get_net_ns+0xb0/0xb0
do_sys_poll+0x63c/0xdd0
Problem is that __mptcp_tcp_fallback() releases the mptcp socket lock,
but after recent change it doesn't do this in all of its return paths.
To fix this, remove the unlock from __mptcp_tcp_fallback() and
always do the unlock in the caller.
Also add a small comment as to why we have this
__mptcp_needs_tcp_fallback().
Fixes: 0b4f33def7bbde ("mptcp: fix tcp fallback crash")
Reported-by: syzbot+e56606435b7bfeea8cf5@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
0 files changed, 0 insertions, 0 deletions